Expand F5 and Fortinet documentation

Explain currently-supported authentication modes, and request feedback on additional modes.

Explain Fortinet's misfeature/design flaw, which prevents it from automatically reconnecting after a dropped or roamed connection, without a new authentication. Request feedback if anyone has acceess to a Fortinet VPN that *doesn't* have this flaw.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

diff --git a/www/f5.xml b/www/f5.xml
index ea2830b64b8be56d5f9113ffd8d4792f0efd5a0e..58db24f5415e24cd4a1ce78d4cbe4307bf3f8e29 100644 (file)
--- a/www/f5.xml
+++ b/www/f5.xml
@@ -5,14 +5,16 @@
        <VAR match="VAR_SEL_F5" replace="selected" />
        <PARSE file="menu1.xml" />
        <PARSE file="menu2-protocols.xml" />
-       
+
        <INCLUDE file="inc/content.tmpl" />
 
 <h1>F5 SSL VPN</h1>
 
 <p>Experimental support for <a
 href="https://www.f5.com/services/resources/glossary/ssl-vpn">F5 SSL
-VPN</a> was added to OpenConnect in March 2021. It is a PPP-based
+VPN</a> was added to OpenConnect in March 2021. It is also known as BIG-IP in
+some documentation. It is a
+<a href="https://en.wikipedia.org/wiki/Point-to-Point_Protocol">PPP</a>-based
 protocol using the native PPP support which was merged into the 9.00
 release.</p>
 
@@ -22,8 +24,20 @@ to the command line:
   openconnect --protocol=f5 big-ip.example.com
 </pre></p>
 
+<h2>Quirks and Issues</h2>
+
+<p>Currently, OpenConnect only supports basic username/password
+authentication for F5, along with an optional TLS client certificate
+and the "domain" dropdown used by some F5 VPNs. The domain form field
+can be automatically populated with the <tt>--authgroup</tt> command-line option.
+If you have access to an F5 VPN which uses other types of authentication (e.g.
+RSA or OATH tokens), please send information to <a href="mail.html">the mailing
+list</a> so that we add support to OpenConnect.</p>
+
 <p>OpenConnect does not yet support the UDP transport for F5, and
-will use PPP over TCP for connectivity.</p>
+will use PPP over TCP for connectivity,
+<a href="http://sites.inka.de/~W1011/devel/tcp-tcp.html">which is suboptimal
+for performance</a>.</p>
 
        <INCLUDE file="inc/footer.tmpl" />
 </PAGE>

diff --git a/www/fortinet.xml b/www/fortinet.xml
index e484bb97c006548a3c2dd3132c15926ecf181fa3..bf751fb2cb1a7cf8b4655e713c568833a7f55f34 100644 (file)
--- a/www/fortinet.xml
+++ b/www/fortinet.xml
@@ -5,14 +5,16 @@
        <VAR match="VAR_SEL_FORTINET" replace="selected" />
        <PARSE file="menu1.xml" />
        <PARSE file="menu2-protocols.xml" />
-       
+
        <INCLUDE file="inc/content.tmpl" />
 
 <h1>Fortinet SSL VPN</h1>
 
 <p>Experimental support for <a
 href="https://www.fortinet.com/products/vpn">Fortinet SSL
-VPN</a> was added to OpenConnect in March 2021. It is a PPP-based
+VPN</a> was added to OpenConnect in March 2021. It is also known as FortiGate
+in some documentation. It is a
+<a href="https://en.wikipedia.org/wiki/Point-to-Point_Protocol">PPP</a>-based
 protocol using the native PPP support which was merged into the 9.00
 release.</p>
 
@@ -22,8 +24,33 @@ to the command line:
   openconnect --protocol=fortinet fortigate.example.com
 </pre></p>
 
+<h2>Quirks and Issues</h2>
+
+<p>In terms of authentication for Fortinet VPNs, OpenConnect currently supports
+basic username/password, optional TLS client certificate, and optional multifactor
+authentication token entry via the "tokeninfo" challenge/response mechanism (which
+appears to be the most common mechanism by which Fortinet VPNs support multifactor
+authentication). If you have access to a Fortinet VPN which uses other types of
+authentication, please send information to <a href="mail.html">the mailing
+list</a> so that we add support to OpenConnect.</p>
+
+<p>The Fortinet protocol appears <i>not</i> to allow its
+post-authentication cookie (as output by <tt>--authenticate</tt>) to
+be used to reestablish a dropped connection. This means that if the
+client loses its connection to the gateway (for example, due to a
+network outage, or after roaming to a different physical adapter) a
+new authentication will <i>always</i> be required. This is a substantial
+design flaw which is not present in any of the other protocols
+supported by OpenConnect; if you have access to a Fortinet VPN which
+<i>can</i> automatically reconnect after a dropped connection,
+please send information to <a href="mail.html">the mailing list</a>
+so we can understand it better, and whether we can support this feature
+on other Fortinet VPNs.</p>
+
 <p>OpenConnect does not yet support the UDP transport for Fortinet, and
-will use PPP over TCP for connectivity.</p>
+will use PPP over TCP for connectivity,
+<a href="http://sites.inka.de/~W1011/devel/tcp-tcp.html">which is suboptimal
+for performance</a>.</p>
 
        <INCLUDE file="inc/footer.tmpl" />
 </PAGE>